Extracted

• • Target

    387e1b2f16fd0cec1bd93a25a2006930N.exe

  • Size

    8.7MB

  • MD5

    387e1b2f16fd0cec1bd93a25a2006930

  • SHA1

    858f35e818841ab60585e102921b0cb0187ef760

  • SHA256

    c1cd4f8be6f0a8540c21d907d124640def26c753236fe71ba79f97761bcd41a0

  • SHA512

    89dcb358791b804d7555de78456f8efbdea2999da23edb84ea369ce01b4e13571e7f177d2ef6f5a1889cadba463a83c4c7176617170b30afaa3ade0df68dc422

  • SSDEEP

    196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbk:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGm4

  Score

  10^/10

  njratjjjdefense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2